Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects attempts to execute setuid binaries via a web shell by looking for the string "chmod+s" in HTTP URI requests. This indicates an attacker trying to set the SUID bit on a file, which is a common technique for privilege escalation on Linux/Unix systems.
This rule detects the download of a file that appears to be an Office document template designed for remote template injection. It specifically looks for HTTP responses containing the strings "[Content_Types].xml" and "attachedTemplate" (case-insensitive) within the file data, which are indicators of a malicious Office document attempting to load a remote template.
MFA OTP Phishing Page Detected
Suricata
This rule detects potential MFA OTP phishing pages by inspecting HTTP URIs for the presence of both 'verify' and 'otp' keywords, case-insensitively. This combination in a URI is indicative of a page designed to trick users into submitting their One-Time Passwords (OTPs) for multi-factor authentication.
Havoc C2 Agent Beacon Detected
Suricata
This rule detects beaconing activity associated with the Havoc C2 agent. It specifically looks for HTTP POST requests to the '/login' URI, with a User-Agent header of 'Mozilla/5.0', and a data size between 101 and 499 bytes. A threshold of 10 such events within 60 seconds from the same source IP triggers the alert, indicating potential command and control communication.
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.
WebDAV File Upload Exfiltration
Suricata
This rule detects potential WebDAV file upload exfiltration attempts by monitoring HTTP traffic for the 'PROPFIND' method. It uses a threshold of 10 occurrences within 60 seconds from the same source IP address to identify suspicious activity, indicating a possible attempt to enumerate or exfiltrate files via WebDAV.
This rule detects attempts at path traversal vulnerabilities by looking for the string "../../../" in HTTP URIs. This pattern is commonly used by attackers to navigate directory structures outside of the intended web root.
This rule detects attempts to inject client-side scripts, commonly known as Cross-Site Scripting (XSS), by looking for the string "<script>" within the HTTP URI of network traffic. This is a common indicator of an attacker trying to execute malicious scripts in a user's browser.
This rule detects attempts at SQL Injection by looking for the specific string "' OR '1'='1" within the HTTP URI. This string is a common payload used in SQL injection attacks to bypass authentication or extract data by always evaluating to true.
This rule detects the presence of a common China Chopper web shell pattern in HTTP client body content. Specifically, it looks for the string "eval(base64_decode(" (case-insensitive) within HTTP requests flowing to the server. This pattern is characteristic of how China Chopper web shells execute commands on compromised web servers.
This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.
This rule detects potential phishing landing pages by looking for HTTP responses that contain both 'login' and 'microsoft' in the URI, and where the HTTP host is an IP address. This combination suggests an attempt to mimic a Microsoft login page hosted on an IP address rather than a legitimate domain, which is a common tactic in phishing attacks.
This rule detects attempts at SQL Injection using the 'UNION SELECT' statement within HTTP URI requests. It specifically looks for the case-insensitive string 'UNION SELECT' in the URI of HTTP traffic flowing to the server.
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
This rule detects potential web shell access by looking for HTTP requests to PHP files that contain a 'cmd=' parameter in the URI. This pattern is commonly used by web shells to execute commands on a compromised web server, aligning with MITRE ATT&CK technique T1505.003 for web shell persistence.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
This rule detects attempts to list processes via a web shell by looking for the string "tasklist" (case-insensitive) in the HTTP URI. This activity is indicative of an attacker using a compromised web server to gain information about the system, specifically process enumeration, which aligns with the MITRE ATT&CK technique T1057 (Process Discovery).
This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.
This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.
Page 106 of 116